From 9f7a1598dfc87aa7eaa8ef64353884c670b85a1b Mon Sep 17 00:00:00 2001
From: Alex Ionescu <github@ionescu.sh>
Date: Sat, 22 Nov 2025 15:06:03 +0100
Subject: [PATCH] nixos/pam: add rule for `pam_umask`

---
 nixos/modules/security/pam.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index 21859a64d74b..3bcac1371081 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -583,6 +583,13 @@ let
           '';
         };
 
+        enableUMask = lib.mkOption {
+          default = config.security.pam.enableUMask;
+          defaultText = lib.literalExpression "config.security.pam.enableUMask";
+          type = lib.types.bool;
+          description = "If enabled, the pam_umask module will be loaded.";
+        };
+
         failDelay = {
           enable = lib.mkOption {
             type = lib.types.bool;
@@ -1292,6 +1299,12 @@ let
                   disable = cfg.ttyAudit.disablePattern;
                 };
               }
+              {
+                name = "umask";
+                enable = cfg.enableUMask;
+                control = "optional";
+                modulePath = "${package}/lib/security/pam_umask.so";
+              }
               {
                 name = "systemd_home";
                 enable = config.services.homed.enable;
@@ -2208,6 +2221,8 @@ in
       };
     };
 
+    security.pam.enableUMask = lib.mkEnableOption "umask PAM module";
+
     security.pam.enableEcryptfs = lib.mkEnableOption "eCryptfs PAM module (mounting ecryptfs home directory on login)";
     security.pam.enableFscrypt = lib.mkEnableOption ''
       fscrypt, to automatically unlock directories with the user's login password.